[matt2e]

Summary

Fixes the cargo-deny --locked check failure in the Rust and tool integration job that now blocks every push, e.g. run 42597238033 on #2581.

RUSTSEC-2026-0459 (libsqlite3-sys via C SQLite CVE-2026-119375) was published to the RustSec database at 2026-11-09T09:58Z. Main's last run (58116b8) passed its Rust job at 09:40Z, before the advisory existed, so main's next push fails the same way. #2581 and renovate #873 are blocked on this.

The advisory

SQLite before 3.54.0 can return uninitialized page-cache memory when a database file is opened together with a sibling -wal file whose page size differs from the database's. It is a local information disclosure that needs the victim to open a crafted database and -wal pair written by a less trusted party. The fix is libsqlite3-sys 0.39 (SQLite 3.54), shipped with rusqlite 0.41.

Why an ignore rather than the upgrade

• Cargo.lock has libsqlite3-sys 0.38.2 via rusqlite 0.40.2. Buzz declares rusqlite = "0.40", and mesh-llm-log-store (mesh-llm-sdk rev 5d19ca6, via buzz-mesh-compute) also declares rusqlite = "0.40", so it cannot take 0.41. libsqlite3-sys has links = "sqlite3", so 0.38 and 0.39 cannot coexist in one lockfile.
• Renovate's bump to rusqlite 0.41 (fix(deps): update all non-major dependencies #873, head becc3aa) fails for exactly this reason: failed to select a version for libsqlite3-sys ... conflicts with a previous package which links to sqlite3.
• mesh-llm's current main (622a92b, 2026-11-09) still pins rusqlite 0.40 and locks libsqlite3-sys 0.38.2, so bumping the mesh-llm rev would not help either. The toolchain (1.98.1) satisfies rusqlite 0.41's MSRV; the pin is the only blocker.

Exposure in Buzz

From the rusqlite callers in this repository and the pinned mesh-llm checkout:

• src-tauri/src/archive/store.rs opens <app data>/archive/events.sqlite3, a WAL database Buzz creates and writes itself.
• src-tauri/src/legacy_communities.rs opens old Buzz's WebKit localstorage.sqlite3 read-only, from the old app's own data directory, to import saved communities once.
• mesh-llm-log-store opens log_store.db under a private root it prepares itself (canonicalised, symlinks rejected).

None is a user-supplied or imported file, and all live under the user's own account, where a writer already has the user's files. Buzz has no feature that opens a database chosen by the user or received from another party.

Change

One ignore entry in deny.toml's [advisories], in the style of the existing entries: a comment with the exposure and the removal condition, plus a reason. Remove it when mesh-llm moves to rusqlite 0.41 and Buzz follows.

Validation

• Before: ./bin/cargo-deny --locked check advisories → error[vulnerability]: libsqlite3-sys via C SQLite CVE-2026-119375, advisories FAILED.
• After: ./bin/cargo-deny --locked check → advisories ok, bans ok, licenses ok, sources ok. Remaining warnings (git sources, duplicates, yanked async-executor/clipboard-win/nostr-sdk, undetected RUSTSEC-2026-0381) are unchanged from main.
• git diff --check passed.
• Not run locally: the rest of the Rust job (fmt, clippy, tests). The change touches no Rust source or lockfile; hosted CI covers it.

🤖 Generated with Claude Code